CVE-2026-6338: HTTP request smuggling in Kong Enteprise Gateway
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict or inspect untrusted HTTP/1.1 traffic to Kong Gateway Enterprise at the network perimeter (firewall, ACLs, or WAF). Block, rate-limit, or normalize HTTP/1.1 requests from untrusted sources to mitigate HTTP request smuggling and desynchronization.
- Operational
Monitor HTTP request logs and traffic for signs of request smuggling or desynchronization (anomalous request framing or unexpected responses). Quarantine or block offending clients and apply vendor security updates for Kong Gateway Enterprise when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6338?
CVE-2026-6338 has a medium severity rating with a CVSS score of 4.9.
What products are affected by CVE-2026-6338?
CVE-2026-6338 affects the Kong Gateway Enterprise versions 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14.
How do I fix CVE-2026-6338?
To fix CVE-2026-6338, update to the latest patched version of Kong Gateway Enterprise.
What type of vulnerability is CVE-2026-6338?
CVE-2026-6338 is a HTTP request smuggling and desynchronization vulnerability.
What causes CVE-2026-6338?
CVE-2026-6338 is caused by a parsing flaw in Kong's HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.